Game Flow Script Modding (Tomb Raider I-III Remastered)

MuruCoder · 09-01-25, 17:21

As mentioned in TRosettaStone3, the gameflow for original TR2 and TR3 such as which levels come in what order are controlled by a script file called TOMBPC.DAT. TR1 has such data hardcoded in the EXE. In the Remasters these data seem to be hardcoded in the DLL files. I haven't tested everything but the Script Opcodes seem different as well. Here's what I know.

TR1 - tomb1.dll

Ambient Tracks

TR2 - tomb2.dll

TR3 - tomb3.dll

MuruCoder · 09-01-25, 17:25

Changing ambient tracks in TR1 seem easy enough.

In tomb1.dll at offset 0xAF5C8 we have the following values.

Code:

00 00 05 00 05 00 05 00 05 00 3A 00 3A 00 3A 00 39 00 39 00 3A 00 3A 00 3A 00 ...

I didn't try all of it but each 2 bytes is a track number corresponding to the TRACKS/OGG file names (TR2 is not so direct about this numbering).

00 00 - Manor Track (No Ambient)
05 00 - First Level Track (Plays "5.OGG")
05 00 - Second Level Track (Plays "5.OGG")
... and so on, keep counting 2 bytes per level.

I've only tried the first 3 and they work. Just convert the desired track number to hex and type it in here to have the corresponding OGG file played. For example to play "122.OGG" type "7A 00". Yes, non-existing OGG file numbers can be used and they play but so far I'm not sure if this breaks any other audio at any point in the game.

MuruCoder · 09-01-25, 17:29

In tomb2.dll at offset 0x000DF5D0 we have an array of offsets pointing to individual level scripts. These however are runtime offsets and must be converted to file offsets so we can find them in Hex Editor.

There's 216 bytes of data, each is 8 bytes long therefore 27 entries. TR2 has 24 levels including Manor and Expansion so I'm assuming the final 3 might be for Demo entries. There are 3 file names in the DLL for "DEMO[X].DEM" files but the files themselves seems to be missing or perhaps the ones in TR3/DATA folder are used or maybe these are unused.

Code:

08 0F 11 80 01 00 00 00 80 11 11 80 01 00 00 00 
48 10 11 80 01 00 00 00 C0 11 11 80 01 00 00 00 
30 11 11 80 01 00 00 00 D8 0E 11 80 01 00 00 00
18 0F 11 80 01 00 00 00 D8 0F 11 80 01 00 00 00
B0 0F 11 80 01 00 00 00 08 10 11 80 01 00 00 00
88 10 11 80 01 00 00 00 B8 10 11 80 01 00 00 00
F0 11 11 80 01 00 00 00 70 0E 11 80 01 00 00 00
00 11 11 80 01 00 00 00 20 12 11 80 01 00 00 00
50 0F 11 80 01 00 00 00 A0 0E 11 80 01 00 00 00
80 12 11 80 01 00 00 00 F0 10 11 80 01 00 00 00
38 10 11 80 01 00 00 00 70 11 11 80 01 00 00 00
B8 0E 11 80 01 00 00 00 C8 0E 11 80 01 00 00 00
A0 12 11 80 01 00 00 00 78 10 11 80 01 00 00 00
A0 0F 11 80 01 00 00 00

The red marked are the 8 bytes for Manor, the blue are the 8 bytes for the First Level and so on...

I've shared ALL the converted Offsets and Script Datas for your convenience but for those interested, I'll explain the conversion using the first one as example.

Take the 8 bytes in reverse order so 08 0F 11 80 01 00 00 00 becomes 0x0000000180110F08.
The magic base address in this case is 0x0000000180110000.
Simply subtract the base address from the offset. 0x0000000180110F08 - 0x0000000180110000 = 0x0000000000000F08.
Let's shorten it to 4 bytes by getting rid of leading zeros: 0x00000F08
Now the secondary base address is 0x0010EC00. Simply add the two.
So the offset we need for the Hex Editor is 0x0010EC00 + 0x00000F08 = 0x0010FB08!!!
(Shortcut) In this particular case, since "11 80 01" values are the same for all of them including the first base adress, you can simply take the first 2 bytes of each 8 byte block, reverse the order and add it to 0x0010EC00 to arrive at the same number.

Great we found the scripting data offset for the Manor level, it's 0x0010FB08. This is what we have at that address.

0x0010FB08 ~ Lara's Home ~ ASSAULT.TR2

Code:

08 00 00 00 09 00 00 00 01 00 00 00 14 00

As mentioned here these must be 2 byte Opcodes/Operands but the Opcodes seem different. I think "14 00" is the script ending opcode for Remasters which is "09 00 - End - Close script sequence" in the originals. Here "09 00" is used for playing audio tracks instead.

MuruCoder · 09-01-25, 17:31

Here're the converted Offsets and Datas for each TR2 Level Script entry for locating them in a Hex Editor.

0x0010FB08 ~ Lara's Home ~ ASSAULT.TR2

Code:

08 00 00 00 09 00 00 00 01 00 00 00 14 00

0x0010FD80 ~ The Great Wall ~ WALL.TR2

Code:

00 00 01 00 00 00 02 00 09 00 21 00 0b 00 06 00 0b 00 0d 00 0b 00 0d 00 0b 00 0f 00 0c 00 0f 00 0c 00 10 00 0c 00 10 00 0c 00 10 00 01 00 01 00 09 00 03 00 04 00 00 00 03 00 05 00 14 00

0x0010FC48 ~ Venice ~ BOAT.TR2

Code:

09 00 00 00 0b 00 09 00 0b 00 09 00 0b 00 09 00 0b 00 09 00 0c 00 0f 00 0c 00 0f 00 0c 00 10 00 0c 00 10 00 01 00 02 00 05 00 14 00

0x0010FDC0 ~ Bartoli's Hideout ~ VENICE.TR2

Code:

09 00 00 00 10 00 0b 00 08 00 0b 00 08 00 0b 00 08 00 0b 00 08 00 0c 00 10 00 0c 00 10 00 0c 00 10 00 0c 00 10 00 01 00 03 00 05 00 14 00

0x0010FD30 ~ Opera House ~ OPERA.TR2

Code:

09 00 1f 00 0b 00 03 00 0b 00 0a 00 0b 00 0a 00 0b 00 0a 00 0b 00 0a 00 0c 00 0f 00 0c 00 0f 00 0c 00 10 00 0c 00 10 00 0c 00 10 00 01 00 04 00 09 00 04 00 03 00 05 00 14 00

0x0010FAD8 ~ Offshore Rig ~ RIG.TR2

Code:

00 00 03 00 09 00 3a 00 0a 00 08 00 0d 00 0b 00 03 00 0b 00 0a 00 0b 00 0a 00 0c 00 10 00 0c 00 10 00 0c 00 10 00 01 00 05 00 05 00 14 00

0x0010FB18 ~ Diving Area ~ PLATFORM.TR2

Code:

09 00 3a 00 0b 00 0a 00 0b 00 0a 00 0b 00 0a 00 0b 00 0a 00 0c 00 0f 00 0c 00 10 00 0c 00 10 00 0c 00 10 00 01 00 06 00 09 00 05 00 03 00 05 00 14 00

0x0010FBD8 ~ 40 Fathoms ~ UNWATER.TR2

Code:

00 00 04 00 09 00 22 00 0b 00 0b 00 0b 00 0b 00 0b 00 0b 00 0b 00 0b 00 0c 00 0f 00 0c 00 0f 00 0c 00 10 00 0c 00 10 00 01 00 07 00 05 00 14 00

0x0010FBB0 ~ Wreck of the Maria Doria ~ KEEL.TR2

Code:

09 00 1f 00 0b 00 06 00 0b 00 0d 00 0b 00 0d 00 0c 00 10 00 0c 00 10 00 0c 00 10 00 01 00 08 00 05 00 14 00

0x0010FC08 ~ Living Quarters ~ LIVING.TR2

Code:

09 00 22 00 0b 00 0c 00 0b 00 0c 00 0b 00 0c 00 0b 00 0c 00 0c 00 0f 00 0c 00 0f 00 0c 00 10 00 0c 00 10 00 01 00 09 00 05 00 14 00

0x0010FC88 ~ The Deck ~ DECK.TR2

Code:

09 00 1f 00 0b 00 0d 00 0b 00 0d 00 0b 00 0d 00 0b 00 0d 00 0c 00 10 00 0c 00 10 00 0c 00 10 00 0c 00 10 00 01 00 0a 00 05 00 14 00

0x0010FCB8 ~ Tibetan Foothills ~ SKIDOO.TR2

Code:

00 00 05 00 09 00 21 00 0b 00 fe 03 0b 00 0a 00 0b 00 0a 00 0b 00 0a 00 0b 00 0a 00 0c 00 10 00 0c 00 10 00 0c 00 10 00 0c 00 10 00 01 00 0b 00 05 00 14 00

0x0010FDF0 ~ Barkhang Monastery ~ MONASTRY.TR2

Code:

09 00 00 00 0b 00 fe 03 0b 00 0c 00 0b 00 0c 00 0b 00 0c 00 0b 00 0c 00 0c 00 0f 00 0c 00 10 00 0c 00 10 00 0c 00 10 00 01 00 0c 00 05 00 14 00

0x0010FA70 ~ Catacombs of the Talion ~ CATACOMB.TR2

Code:

09 00 1f 00 0b 00 0d 00 0b 00 0d 00 0b 00 0c 00 0b 00 0c 00 0c 00 0f 00 0c 00 10 00 0c 00 10 00 0c 00 10 00 01 00 0d 00 05 00 14 00

0x0010FD00 ~ Ice Palace ~ ICECAVE.TR2

Code:

09 00 1f 00 0b 00 0d 00 0b 00 0d 00 0b 00 0d 00 0b 00 0d 00 0c 00 10 00 0c 00 10 00 0c 00 10 00 0c 00 10 00 01 00 0e 00 05 00 14 00

0x0010FE20 ~ Temple of Xian ~ EMPRTOMB.TR2

Code:

00 00 06 00 09 00 3b 00 0b 00 0a 00 0b 00 0a 00 0b 00 0a 00 0b 00 0a 00 0b 00 0a 00 0b 00 0a 00 0b 00 0a 00 0b 00 0a 00 0c 00 0f 00 0c 00 0f 00 0c 00 0f 00 0c 00 0f 00 0c 00 0f 00 0c 00 0f 00 0c 00 10 00 0c 00 10 00 01 00 0f 00 09 00 1e 00 04 00 00 00 03 00 05 00 14 00

0x0010FB50 ~ Floating Islands ~ FLOATING.TR2

Code:

09 00 3b 00 0f 00 00 26 0b 00 0d 00 0b 00 0d 00 0b 00 0d 00 0b 00 0d 00 0b 00 0d 00 0b 00 0d 00 0b 00 0d 00 0b 00 0d 00 0c 00 10 00 0c 00 0f 00 0c 00 0f 00 0c 00 0f 00 0c 00 0f 00 0c 00 0f 00 0c 00 0f 00 0c 00 0f 00 01 00 10 00 05 00 14 00

0x0010FAA0 ~ The Dragon's Lair ~ XIAN.TR2

Code:

08 00 00 00 09 00 3b 00 01 00 11 00 05 00 00 00 07 00 14 00

0x0010FE80 ~ Home Sweet Home ~ HOUSE.TR2

Code:

08 00 00 00 0b 00 ff 03 0a 00 09 00 09 00 00 00 0d 00 0e 00 01 00 12 00 09 00 34 00 06 00 14 00

0x0010FCF0 ~ The Cold War ~ LEVEL1.TR2

Code:

09 00 21 00 01 00 13 00 05 00 14 00

0x0010FC38 ~ Fool's Gold ~ LEVEL2.TR2

Code:

09 00 3a 00 01 00 14 00 05 00 14 00

0x0010FD70 ~ Furnace of the Gods ~ LEVEL3.TR2

Code:

09 00 3b 00 01 00 15 00 05 00 14 00

0x0010FAB8 ~ Kingdom ~ LEVEL4.TR2

Code:

09 00 1f 00 0b 00 fb 03 01 00 16 00 06 00 14 00

0x0010FAC8 ~ Nightmare in Vegas ~ LEVEL5.TR2

Code:

09 00 22 00 01 00 17 00 05 00 14 00

0x0010FEA0 ~ DEMO 1 ~ DEMO1.DEM

Code:

09 00 00 00 02 00 18 00 14 00

0x0010FC78 ~ DEMO 2 ~ DEMO2.DEM

Code:

09 00 20 00 02 00 19 00 14 00

0x0010FBA0 ~ DEMO 3 ~ DEMO3.DEM

Code:

09 00 21 00 0b 00 fe 03 02 00 1a 00 14 00

I'm not sure if the last 3 demo levels are properly implemented or not.

MuruCoder · 09-01-25, 17:37

In tomb3.dll at offset 0x0012F570 we have an array of offsets pointing to individual level scripts. These however are runtime offsets and must be converted to file offsets so we can find them in Hex Editor.

There's 216 bytes of data, each is 8 bytes long therefore 27 entries and TR3 does have 27 levels including Manor and Expansion.

Code:

E8 40 16 80 01 00 00 00 60 41 16 80 01 00 00 00
B8 40 16 80 01 00 00 00 40 42 16 80 01 00 00 00
D8 41 16 80 01 00 00 00 98 41 16 80 01 00 00 00
18 41 16 80 01 00 00 00 88 42 16 80 01 00 00 00
68 40 16 80 01 00 00 00 78 40 16 80 01 00 00 00
E8 41 16 80 01 00 00 00 70 42 16 80 01 00 00 00
50 40 16 80 01 00 00 00 C0 41 16 80 01 00 00 00
00 42 16 80 01 00 00 00 38 41 16 80 01 00 00 00
20 42 16 80 01 00 00 00 08 41 16 80 01 00 00 00
48 41 16 80 01 00 00 00 D0 40 16 80 01 00 00 00
80 41 16 80 01 00 00 00 98 40 16 80 01 00 00 00
60 42 16 80 01 00 00 00 F8 40 16 80 01 00 00 00
B0 41 16 80 01 00 00 00 50 42 16 80 01 00 00 00
A8 40 16 80 01 00 00 00

The red marked are the 8 bytes for Manor, the blue are the 8 bytes for the First Level and so on...

I've shared ALL the converted Offsets and Script Datas for your convenience but for those interested, I'll explain the conversion using the first one as example.

Take the 8 bytes in reverse order so E8 40 16 80 01 00 00 00 becomes 0x00000001801640E8.
The magic base address in this case is 0x0000000180163000.
Simply subtract the base address from the offset. 0x00000001801640E8 - 0x0000000180163000 = 0x00000000000010E8.
Let's shorten it to 4 bytes by getting rid of leading zeros: 0x000010E8
Now the secondary base address is 0x00161A00. Simply add the two.
So the offset we need for the Hex Editor is 0x00161A00 + 0x000010E8 = 0x00162AE8!!!
(Shortcut) In this particular case, since "16 80 01" values are the same for all of them including the first base adress, they can be ignored. However first base address also has a "3000" that needs to be considered so we can subtract it from the second base address and use that new secondary address instead. So 0x00161A00 - 0x00003000 = 0x0015EA00 is our new secondary address. Now you can simply take the first 2 bytes of each 8 byte block, reverse the order and add it to 0x0015EA00 to arrive at the same number.

Great we found the scripting data offset for the Manor level, it's 0x00162AE8. This is what we have at that address.

0x00162AE8 ~ Lara's Home ~ HOUSE.TR2

Code:

09 00 02 00 01 00 00 00 14 00

As mentioned here these must be 2 byte Opcodes/Operands but the Opcodes seem different. I think "14 00" is the script ending opcode for Remasters which is "09 00 - End - Close script sequence" in the originals. Here "09 00" is used for playing audio tracks instead.

MuruCoder · 09-01-25, 17:39

Here're the converted Offsets and Datas for each TR3 Level Script entry for locating them in a Hex Editor.

0x00162AE8 ~ Lara's Home ~ HOUSE.TR2

Code:

09 00 02 00 01 00 00 00 14 00

0x00162B60 ~ Jungle ~ JUNGLE.TR2

Code:

00 00 01 00 09 00 22 00 11 00 01 00 01 00 09 00 40 00 04 00 00 40 12 00 03 00 05 00 14 00

0x00162AB8 ~ Temple Ruins ~ TEMPLE.TR2

Code:

09 00 22 00 01 00 02 00 09 00 45 00 04 00 00 40 03 00 05 00 14 00

0x00162C40 ~ The River Ganges ~ QUADCHAS.TR2

Code:

09 00 22 00 11 00 01 00 03 00 05 00 14 00

0x00162BD8 ~ Caves Of Kaliya ~ TONYBOSS.TR2

Code:

09 00 1e 00 01 00 04 00 00 00 02 00 05 00 14 00

0x00162B98 ~ Coastal Village ~ SHORE.TR2

Code:

09 00 20 00 01 00 05 00 09 00 44 00 04 00 00 40 03 00 05 00 14 00

0x00162B18 ~ Crash Site ~ CRASH.TR2

Code:

09 00 21 00 0b 00 fb 03 01 00 06 00 09 00 41 00 04 00 00 40 03 00 05 00 14 00

0x00162C88 ~ Madubu Gorge ~ RAPIDS.TR2

Code:

09 00 24 00 01 00 07 00 05 00 14 00

0x00162A68 ~ Temple Of Puna ~ TRIBOSS.TR2

Code:

09 00 1e 00 01 00 08 00 05 00 14 00

0x00162A78 ~ Thames Wharf ~ ROOFS.TR2

Code:

09 00 49 00 0f 00 00 07 11 00 01 00 09 00 09 00 43 00 04 00 00 c0 12 00 03 00 05 00 14 00

0x00162BE8 ~ Aldwych ~ SEWER.TR2

Code:

09 00 4a 00 01 00 0a 00 09 00 3f 00 04 00 00 40 03 00 05 00 14 00

0x00162C70 ~ Lud's Gate ~ TOWER.TR2

Code:

09 00 1f 00 01 00 0b 00 09 00 47 00 04 00 00 40 03 00 05 00 14 00

0x00162A50 ~ City ~ OFFICE.TR2

Code:

09 00 4e 00 0f 00 00 14 11 00 01 00 0c 00 05 00 14 00

0x00162BC0 ~ Nevada Desert ~ NEVADA.TR2

Code:

09 00 21 00 01 00 0d 00 09 00 48 00 04 00 00 40 03 00 05 00 14 00

0x00162C00 ~ High Security Compound ~ COMPOUND.TR2

Code:

09 00 1b 00 0a 00 08 00 0d 00 0e 00 01 00 0e 00 09 00 46 00 04 00 00 40 03 00 05 00 14 00

0x00162B38 ~ Area 51 ~ AREA51.TR2

Code:

09 00 1b 00 01 00 0f 00 05 00 14 00

0x00162C20 ~ Antarctica ~ ANTARC.TR2

Code:

00 00 03 00 09 00 1c 00 13 00 01 00 10 00 09 00 3e 00 04 00 00 40 03 00 05 00 14 00

0x00162B08 ~ RX-Tech Mines ~ MINES.TR2

Code:

09 00 1e 00 01 00 11 00 05 00 14 00

0x00162B48 ~ Lost City Of Tinnos ~ CITY.TR2

Code:

09 00 1a 00 01 00 12 00 09 00 42 00 04 00 00 40 03 00 05 00 14 00

0x00162AD0 ~ Meteorite Cavern ~ CHAMBER.TR2

Code:

09 00 7b 00 13 00 01 00 13 00 00 00 04 00 06 00 14 00

0x00162B80 ~ All Hallows ~ STPAUL.TR2

Code:

09 00 1e 00 0f 00 10 27 11 00 01 00 14 00 05 00 14 00

0x00162A98 ~ Highland Fling ~ SCOTLAND.TR2

Code:

09 00 24 00 11 00 01 00 15 00 05 00 14 00

0x00162C60 ~ Willard's Lair ~ WILLSDEN.TR2

Code:

09 00 1e 00 01 00 16 00 05 00 14 00

0x00162AF8 ~ Shakespeare Cliff ~ CHUNNEL.TR2

Code:

09 00 4a 00 01 00 17 00 05 00 14 00

0x00162BB0 ~ Sleeping with the Fishes ~ UNDERSEA.TR2

Code:

09 00 1b 00 01 00 18 00 05 00 14 00

0x00162C50 ~ It's a Madhouse! ~ ZOO.TR2

Code:

09 00 22 00 01 00 19 00 05 00 14 00

0x00162AA8 ~ Reunion ~ SLINC.TR2

Code:

09 00 1a 00 01 00 1a 00 06 00 14 00

MuruCoder · 09-01-25, 17:44

Since TR2 & TR3 script opcodes seem different than the originals metioned here, I'll note down what I know & guess so far.

00 00 - FMV - Play FMV (Operand: FMV ID)

01 00 - Level - Play Level (Operand: Level ID)

02 00 - ? Demo - Play Demo (Operand: Demo ID) Not sure if properly implemented

03 00 - Cine - Play Cutscene (No Operand) Not sure where it gets Cutscene ID

04 00 - CutAngle - Match north-south orientation of characters (Operand: Horizontal Rotation ~ angle in degrees * 65536 / 360)

05 00 - Complete - Level Statistics (No Operand)

06 00 - GameComplete - Final Statistics & Credits (No Operand)

07 00 - ? Unknown

08 00 - Secrets - (Operand: Zero means the level does not account for secrets)

09 00 - Track - Play Soundtrack (Operand: Track ID)

0A 00 - StartAnim - Lara starts with the given animation (Operand: Animation ID)

0B 00 - StartInv - Give item to Lara at level-start (Operand: Item ID)

0C 00 - ? Bonus - Give item to Lara at all-secrets-found or NG Plus (Operand: Item ID)

0D 00 - RemoveWeapons - Start the level with no weapons (No Operand)

0E 00 - RemoveAmmo - Start the level without ammunition or medi packs (No Operand)

0F 00 - NoFloor (Operand: Depth = Blocks * 1024) Lara dies when her feet reach the given depth

10 00 - Sunset Gradually dim some lights, used in Bartoli’s Hideout

11 00 - [TR3] Start Rain

12 00 - [TR3] Stop Rain

13 00 - [TR3] Start Snow

14 00 - End - Close script sequence

Opcodes 11, 12, 13 are TR3 only and apply weather effects as I mentioned in this post.

MuruCoder · 09-01-25, 17:53

Sadly, playing background audio (Opcode "09 00") is not as straightforward in TR2. Operand "Track ID" is not simply the TRACKS/OGG file name. Instead it's an index number into a tracks list, starting from zero.

In tomb2.dll at offset 0x000E0850 we have the following bytes.

Code:

02 02 02 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 12 12 13 14 15 16 17 17 18 19 1A 1B 1C 1D 1E 1F 20 21 22 23 24 25 26 27 28 29 2A 2B 2C 2D 2E 2F 30 31 32 33 34 35 36 37 38 39 3A 3B 3C 3D

These are the values that actually correspond to OGG file numbers. Notice there are repeating ones, like "02" repeating 4 times in the beginning. The first one, index zero, is set to "2.OGG" but script code "09 00 00 00" seem to simply ignore it and make the background silent.

You can create non existing OGG files like "122.OGG" and by changing a value in this list to "7A" (122 in hex) you can have that OGG file played instead.

We can't easily extend this list however there's a trick. You can actually point to byte values beyond this list. This list is 66 bytes long and after it comes the following bytes:

Code:

00 00 FF FF 80 FF ...

So since starting from zero means the final byte of the list is at index 65; index 66 will point to the first zero beyond, index 67 will point to the second zero, index 68 will point to the first "FF" and have "255.OGG" played. Index 69 is again an "FF" and then index 70 is "80" for "128.OGG" and so on.

Here're some extra values I found in the vicinity.

Code:

HEX > OGG_NAME
44 > 255.OGG
46 > 128.OGG
5C > 80.OGG
5D > 130.OGG
60 > 160.OGG
70 > 100.OGG
80 > 224.OGG
88 > 240.OGG
A8 > 64.OGG
B8 > 104.OGG
C0 > 120.OGG
C8 > 136.OGG
D8 > 184.OGG
E0 > 208.OGG
E8 > 232.OGG
FC > 76.OGG

For example at 0x0010FB0C change "09 00 00 00" To "09 00 5C 00" and "80.OGG" is played in Manor Level.

We are allowed to use 2 byte operands to go further beyond the list. For example the script "09 00 02 01" will seek the 258th byte from the start of the list, which is a "74" and play "116.OGG".

I'm not sure if using non-existing OGG file numbers breaks any other audio at any point in the game.

MuruCoder · 09-01-25, 17:55

TR3 seems to be just using the operand as the OGG name. For example "09 00 A4 00" plays "164.OGG".

You can even use 2 byte operands so "09 00 A4 24" is playing "9380.OGG". Remember to switch byte order so "A4 24" becomes "0x24A4" in hex which is "9380".

The Manor Level seems to ignore this. It's set to "09 00 02 00" by default so "2.OGG". It's the music that plays in the dining hall but changing the script doesn't change the music. It's probably hardcoded in the level.

I'm not sure if using non-existing OGG file numbers breaks any other audio at any point in the game.

09-01-25, 17:21	#1
MuruCoder Member Joined: Jan 2018 Posts: 1,431	Game Flow Script Modding (Tomb Raider I-III Remastered) As mentioned in TRosettaStone3, the gameflow for original TR2 and TR3 such as which levels come in what order are controlled by a script file called TOMBPC.DAT. TR1 has such data hardcoded in the EXE. In the Remasters these data seem to be hardcoded in the DLL files. I haven't tested everything but the Script Opcodes seem different as well. Here's what I know. TR1 - tomb1.dll Ambient Tracks TR2 - tomb2.dll Game Flow Index Level Script Offsets & Data Script Opcodes Ambient Tracks TR3 - tomb3.dll Game Flow Index Level Script Offsets & Data Script Opcodes Ambient Tracks Last edited by MuruCoder; 09-01-25 at 17:58.

09-01-25, 17:25	#2
MuruCoder Member Joined: Jan 2018 Posts: 1,431	TR1 Ambient Tracks Changing ambient tracks in TR1 seem easy enough. In tomb1.dll at offset 0xAF5C8 we have the following values. Code: 00 00 05 00 05 00 05 00 05 00 3A 00 3A 00 3A 00 39 00 39 00 3A 00 3A 00 3A 00 ... I didn't try all of it but each 2 bytes is a track number corresponding to the TRACKS/OGG file names (TR2 is not so direct about this numbering). 00 00 - Manor Track (No Ambient) 05 00 - First Level Track (Plays "5.OGG") 05 00 - Second Level Track (Plays "5.OGG") ... and so on, keep counting 2 bytes per level. I've only tried the first 3 and they work. Just convert the desired track number to hex and type it in here to have the corresponding OGG file played. For example to play "122.OGG" type "7A 00". Yes, non-existing OGG file numbers can be used and they play but so far I'm not sure if this breaks any other audio at any point in the game. Last edited by MuruCoder; 09-01-25 at 18:17.

09-01-25, 17:29	#3
MuruCoder Member Joined: Jan 2018 Posts: 1,431	TR2 Game Flow Index In tomb2.dll at offset 0x000DF5D0 we have an array of offsets pointing to individual level scripts. These however are runtime offsets and must be converted to file offsets so we can find them in Hex Editor. There's 216 bytes of data, each is 8 bytes long therefore 27 entries. TR2 has 24 levels including Manor and Expansion so I'm assuming the final 3 might be for Demo entries. There are 3 file names in the DLL for "DEMO[X].DEM" files but the files themselves seems to be missing or perhaps the ones in TR3/DATA folder are used or maybe these are unused. Code: 08 0F 11 80 01 00 00 00 80 11 11 80 01 00 00 00 48 10 11 80 01 00 00 00 C0 11 11 80 01 00 00 00 30 11 11 80 01 00 00 00 D8 0E 11 80 01 00 00 00 18 0F 11 80 01 00 00 00 D8 0F 11 80 01 00 00 00 B0 0F 11 80 01 00 00 00 08 10 11 80 01 00 00 00 88 10 11 80 01 00 00 00 B8 10 11 80 01 00 00 00 F0 11 11 80 01 00 00 00 70 0E 11 80 01 00 00 00 00 11 11 80 01 00 00 00 20 12 11 80 01 00 00 00 50 0F 11 80 01 00 00 00 A0 0E 11 80 01 00 00 00 80 12 11 80 01 00 00 00 F0 10 11 80 01 00 00 00 38 10 11 80 01 00 00 00 70 11 11 80 01 00 00 00 B8 0E 11 80 01 00 00 00 C8 0E 11 80 01 00 00 00 A0 12 11 80 01 00 00 00 78 10 11 80 01 00 00 00 A0 0F 11 80 01 00 00 00 The red marked are the 8 bytes for Manor, the blue are the 8 bytes for the First Level and so on... I've shared ALL the converted Offsets and Script Datas for your convenience but for those interested, I'll explain the conversion using the first one as example. Take the 8 bytes in reverse order so 08 0F 11 80 01 00 00 00 becomes 0x0000000180110F08. The magic base address in this case is 0x0000000180110000. Simply subtract the base address from the offset. 0x0000000180110F08 - 0x0000000180110000 = 0x0000000000000F08. Let's shorten it to 4 bytes by getting rid of leading zeros: 0x00000F08 Now the secondary base address is 0x0010EC00. Simply add the two. So the offset we need for the Hex Editor is 0x0010EC00 + 0x00000F08 = 0x0010FB08!!! (Shortcut) In this particular case, since "11 80 01" values are the same for all of them including the first base adress, you can simply take the first 2 bytes of each 8 byte block, reverse the order and add it to 0x0010EC00 to arrive at the same number. Great we found the scripting data offset for the Manor level, it's 0x0010FB08. This is what we have at that address. 0x0010FB08 ~ Lara's Home ~ ASSAULT.TR2 Code: 08 00 00 00 09 00 00 00 01 00 00 00 14 00 As mentioned here these must be 2 byte Opcodes/Operands but the Opcodes seem different. I think "14 00" is the script ending opcode for Remasters which is "09 00 - End - Close script sequence" in the originals. Here "09 00" is used for playing audio tracks instead.

09-01-25, 17:37	#5
MuruCoder Member Joined: Jan 2018 Posts: 1,431	TR3 Game Flow Index In tomb3.dll at offset 0x0012F570 we have an array of offsets pointing to individual level scripts. These however are runtime offsets and must be converted to file offsets so we can find them in Hex Editor. There's 216 bytes of data, each is 8 bytes long therefore 27 entries and TR3 does have 27 levels including Manor and Expansion. Code: E8 40 16 80 01 00 00 00 60 41 16 80 01 00 00 00 B8 40 16 80 01 00 00 00 40 42 16 80 01 00 00 00 D8 41 16 80 01 00 00 00 98 41 16 80 01 00 00 00 18 41 16 80 01 00 00 00 88 42 16 80 01 00 00 00 68 40 16 80 01 00 00 00 78 40 16 80 01 00 00 00 E8 41 16 80 01 00 00 00 70 42 16 80 01 00 00 00 50 40 16 80 01 00 00 00 C0 41 16 80 01 00 00 00 00 42 16 80 01 00 00 00 38 41 16 80 01 00 00 00 20 42 16 80 01 00 00 00 08 41 16 80 01 00 00 00 48 41 16 80 01 00 00 00 D0 40 16 80 01 00 00 00 80 41 16 80 01 00 00 00 98 40 16 80 01 00 00 00 60 42 16 80 01 00 00 00 F8 40 16 80 01 00 00 00 B0 41 16 80 01 00 00 00 50 42 16 80 01 00 00 00 A8 40 16 80 01 00 00 00 The red marked are the 8 bytes for Manor, the blue are the 8 bytes for the First Level and so on... I've shared ALL the converted Offsets and Script Datas for your convenience but for those interested, I'll explain the conversion using the first one as example. Take the 8 bytes in reverse order so E8 40 16 80 01 00 00 00 becomes 0x00000001801640E8. The magic base address in this case is 0x0000000180163000. Simply subtract the base address from the offset. 0x00000001801640E8 - 0x0000000180163000 = 0x00000000000010E8. Let's shorten it to 4 bytes by getting rid of leading zeros: 0x000010E8 Now the secondary base address is 0x00161A00. Simply add the two. So the offset we need for the Hex Editor is 0x00161A00 + 0x000010E8 = 0x00162AE8!!! (Shortcut) In this particular case, since "16 80 01" values are the same for all of them including the first base adress, they can be ignored. However first base address also has a "3000" that needs to be considered so we can subtract it from the second base address and use that new secondary address instead. So 0x00161A00 - 0x00003000 = 0x0015EA00 is our new secondary address. Now you can simply take the first 2 bytes of each 8 byte block, reverse the order and add it to 0x0015EA00 to arrive at the same number. Great we found the scripting data offset for the Manor level, it's 0x00162AE8. This is what we have at that address. 0x00162AE8 ~ Lara's Home ~ HOUSE.TR2 Code: 09 00 02 00 01 00 00 00 14 00 As mentioned here these must be 2 byte Opcodes/Operands but the Opcodes seem different. I think "14 00" is the script ending opcode for Remasters which is "09 00 - End - Close script sequence" in the originals. Here "09 00" is used for playing audio tracks instead.

09-01-25, 17:39	#6
MuruCoder Member Joined: Jan 2018 Posts: 1,431	TR3 Level Script Offsets & Data Here're the converted Offsets and Datas for each TR3 Level Script entry for locating them in a Hex Editor. 0x00162AE8 ~ Lara's Home ~ HOUSE.TR2 Code: 09 00 02 00 01 00 00 00 14 00 0x00162B60 ~ Jungle ~ JUNGLE.TR2 Code: 00 00 01 00 09 00 22 00 11 00 01 00 01 00 09 00 40 00 04 00 00 40 12 00 03 00 05 00 14 00 0x00162AB8 ~ Temple Ruins ~ TEMPLE.TR2 Code: 09 00 22 00 01 00 02 00 09 00 45 00 04 00 00 40 03 00 05 00 14 00 0x00162C40 ~ The River Ganges ~ QUADCHAS.TR2 Code: 09 00 22 00 11 00 01 00 03 00 05 00 14 00 0x00162BD8 ~ Caves Of Kaliya ~ TONYBOSS.TR2 Code: 09 00 1e 00 01 00 04 00 00 00 02 00 05 00 14 00 0x00162B98 ~ Coastal Village ~ SHORE.TR2 Code: 09 00 20 00 01 00 05 00 09 00 44 00 04 00 00 40 03 00 05 00 14 00 0x00162B18 ~ Crash Site ~ CRASH.TR2 Code: 09 00 21 00 0b 00 fb 03 01 00 06 00 09 00 41 00 04 00 00 40 03 00 05 00 14 00 0x00162C88 ~ Madubu Gorge ~ RAPIDS.TR2 Code: 09 00 24 00 01 00 07 00 05 00 14 00 0x00162A68 ~ Temple Of Puna ~ TRIBOSS.TR2 Code: 09 00 1e 00 01 00 08 00 05 00 14 00 0x00162A78 ~ Thames Wharf ~ ROOFS.TR2 Code: 09 00 49 00 0f 00 00 07 11 00 01 00 09 00 09 00 43 00 04 00 00 c0 12 00 03 00 05 00 14 00 0x00162BE8 ~ Aldwych ~ SEWER.TR2 Code: 09 00 4a 00 01 00 0a 00 09 00 3f 00 04 00 00 40 03 00 05 00 14 00 0x00162C70 ~ Lud's Gate ~ TOWER.TR2 Code: 09 00 1f 00 01 00 0b 00 09 00 47 00 04 00 00 40 03 00 05 00 14 00 0x00162A50 ~ City ~ OFFICE.TR2 Code: 09 00 4e 00 0f 00 00 14 11 00 01 00 0c 00 05 00 14 00 0x00162BC0 ~ Nevada Desert ~ NEVADA.TR2 Code: 09 00 21 00 01 00 0d 00 09 00 48 00 04 00 00 40 03 00 05 00 14 00 0x00162C00 ~ High Security Compound ~ COMPOUND.TR2 Code: 09 00 1b 00 0a 00 08 00 0d 00 0e 00 01 00 0e 00 09 00 46 00 04 00 00 40 03 00 05 00 14 00 0x00162B38 ~ Area 51 ~ AREA51.TR2 Code: 09 00 1b 00 01 00 0f 00 05 00 14 00 0x00162C20 ~ Antarctica ~ ANTARC.TR2 Code: 00 00 03 00 09 00 1c 00 13 00 01 00 10 00 09 00 3e 00 04 00 00 40 03 00 05 00 14 00 0x00162B08 ~ RX-Tech Mines ~ MINES.TR2 Code: 09 00 1e 00 01 00 11 00 05 00 14 00 0x00162B48 ~ Lost City Of Tinnos ~ CITY.TR2 Code: 09 00 1a 00 01 00 12 00 09 00 42 00 04 00 00 40 03 00 05 00 14 00 0x00162AD0 ~ Meteorite Cavern ~ CHAMBER.TR2 Code: 09 00 7b 00 13 00 01 00 13 00 00 00 04 00 06 00 14 00 0x00162B80 ~ All Hallows ~ STPAUL.TR2 Code: 09 00 1e 00 0f 00 10 27 11 00 01 00 14 00 05 00 14 00 0x00162A98 ~ Highland Fling ~ SCOTLAND.TR2 Code: 09 00 24 00 11 00 01 00 15 00 05 00 14 00 0x00162C60 ~ Willard's Lair ~ WILLSDEN.TR2 Code: 09 00 1e 00 01 00 16 00 05 00 14 00 0x00162AF8 ~ Shakespeare Cliff ~ CHUNNEL.TR2 Code: 09 00 4a 00 01 00 17 00 05 00 14 00 0x00162BB0 ~ Sleeping with the Fishes ~ UNDERSEA.TR2 Code: 09 00 1b 00 01 00 18 00 05 00 14 00 0x00162C50 ~ It's a Madhouse! ~ ZOO.TR2 Code: 09 00 22 00 01 00 19 00 05 00 14 00 0x00162AA8 ~ Reunion ~ SLINC.TR2 Code: 09 00 1a 00 01 00 1a 00 06 00 14 00

09-01-25, 17:44	#7
MuruCoder Member Joined: Jan 2018 Posts: 1,431	Script Opcodes Since TR2 & TR3 script opcodes seem different than the originals metioned here, I'll note down what I know & guess so far. 00 00 - FMV - Play FMV (Operand: FMV ID) 01 00 - Level - Play Level (Operand: Level ID) 02 00 - ? Demo - Play Demo (Operand: Demo ID) Not sure if properly implemented 03 00 - Cine - Play Cutscene (No Operand) Not sure where it gets Cutscene ID 04 00 - CutAngle - Match north-south orientation of characters (Operand: Horizontal Rotation ~ angle in degrees * 65536 / 360) 05 00 - Complete - Level Statistics (No Operand) 06 00 - GameComplete - Final Statistics & Credits (No Operand) 07 00 - ? Unknown 08 00 - Secrets - (Operand: Zero means the level does not account for secrets) 09 00 - Track - Play Soundtrack (Operand: Track ID) 0A 00 - StartAnim - Lara starts with the given animation (Operand: Animation ID) 0B 00 - StartInv - Give item to Lara at level-start (Operand: Item ID) 0C 00 - ? Bonus - Give item to Lara at all-secrets-found or NG Plus (Operand: Item ID) 0D 00 - RemoveWeapons - Start the level with no weapons (No Operand) 0E 00 - RemoveAmmo - Start the level without ammunition or medi packs (No Operand) 0F 00 - NoFloor (Operand: Depth = Blocks * 1024) Lara dies when her feet reach the given depth 10 00 - Sunset Gradually dim some lights, used in Bartoli’s Hideout 11 00 - [TR3] Start Rain 12 00 - [TR3] Stop Rain 13 00 - [TR3] Start Snow 14 00 - End - Close script sequence Opcodes 11, 12, 13 are TR3 only and apply weather effects as I mentioned in this post.

09-01-25, 17:53	#8
MuruCoder Member Joined: Jan 2018 Posts: 1,431	TR2 Ambient Tracks Sadly, playing background audio (Opcode "09 00") is not as straightforward in TR2. Operand "Track ID" is not simply the TRACKS/OGG file name. Instead it's an index number into a tracks list, starting from zero. In tomb2.dll at offset 0x000E0850 we have the following bytes. Code: 02 02 02 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 12 12 13 14 15 16 17 17 18 19 1A 1B 1C 1D 1E 1F 20 21 22 23 24 25 26 27 28 29 2A 2B 2C 2D 2E 2F 30 31 32 33 34 35 36 37 38 39 3A 3B 3C 3D These are the values that actually correspond to OGG file numbers. Notice there are repeating ones, like "02" repeating 4 times in the beginning. The first one, index zero, is set to "2.OGG" but script code "09 00 00 00" seem to simply ignore it and make the background silent. You can create non existing OGG files like "122.OGG" and by changing a value in this list to "7A" (122 in hex) you can have that OGG file played instead. We can't easily extend this list however there's a trick. You can actually point to byte values beyond this list. This list is 66 bytes long and after it comes the following bytes: Code: 00 00 FF FF 80 FF ... So since starting from zero means the final byte of the list is at index 65; index 66 will point to the first zero beyond, index 67 will point to the second zero, index 68 will point to the first "FF" and have "255.OGG" played. Index 69 is again an "FF" and then index 70 is "80" for "128.OGG" and so on. Here're some extra values I found in the vicinity. Code: HEX > OGG_NAME 44 > 255.OGG 46 > 128.OGG 5C > 80.OGG 5D > 130.OGG 60 > 160.OGG 70 > 100.OGG 80 > 224.OGG 88 > 240.OGG A8 > 64.OGG B8 > 104.OGG C0 > 120.OGG C8 > 136.OGG D8 > 184.OGG E0 > 208.OGG E8 > 232.OGG FC > 76.OGG For example at 0x0010FB0C change "09 00 00 00" To "09 00 5C 00" and "80.OGG" is played in Manor Level. We are allowed to use 2 byte operands to go further beyond the list. For example the script "09 00 02 01" will seek the 258th byte from the start of the list, which is a "74" and play "116.OGG". I'm not sure if using non-existing OGG file numbers breaks any other audio at any point in the game. Last edited by MuruCoder; 09-01-25 at 18:20.

09-01-25, 17:55	#9
MuruCoder Member Joined: Jan 2018 Posts: 1,431	TR3 Ambient Tracks TR3 seems to be just using the operand as the OGG name. For example "09 00 A4 00" plays "164.OGG". You can even use 2 byte operands so "09 00 A4 24" is playing "9380.OGG". Remember to switch byte order so "A4 24" becomes "0x24A4" in hex which is "9380". The Manor Level seems to ignore this. It's set to "09 00 02 00" by default so "2.OGG". It's the music that plays in the dining hall but changing the script doesn't change the music. It's probably hardcoded in the level. I'm not sure if using non-existing OGG file numbers breaks any other audio at any point in the game. Last edited by MuruCoder; 09-01-25 at 18:21.